California Just Created the First US Registry for AI Auditors. Here Is Why It Matters.

On September 9, California Governor Gavin Newsom signed two bills that quietly do something no US state has attempted before: create a government registry for AI auditors. The framework established by AB 1405 and SB 813 will eventually require third-party verification of AI systems used in hiring, insurance pricing, and other high-stakes decisions. And unlike the heated battles over previous AI legislation, both OpenAI and Anthropic have publicly backed these measures.

Why This Is Different

California has tried to regulate AI before. SB 1047, the "Safe and Secure Innovation for Frontier AI Models Act" that Newsom vetoed in 2024, was aimed squarely at the handful of companies building the most powerful foundation models. Tech industry lobbying against that bill was fierce, and the governor cited concerns about stifling innovation.

AB 1405 and SB 813 take a fundamentally different approach. Instead of targeting model training, they focus on deployment. Any company using AI to make decisions that affect Californians' lives, from screening job applicants to setting insurance premiums, falls within scope. The bills don't dictate what AI can or cannot do. They establish who is allowed to verify that these systems are working as intended.

Two Bills, One Framework

Neither bill functions independently. SB 813, authored by Senator Jerry McNerney, establishes the California Artificial Intelligence Standards and Safety Commission. This body will define what counts as a "covered AI audit" and set the technical standards auditors must meet. AB 1405, from Assemblymember Rebecca Bauer-Kahan, creates the actual registry and the independence requirements for the people and firms on it.

Bauer-Kahan put the rationale plainly: "We cannot expect industry to simply grade its own homework." The independence rules borrow directly from financial auditing standards. Registered auditors cannot hold a financial stake in the companies they audit. They cannot accept employment from those companies within twelve months of completing an audit. These are familiar guardrails, just applied to a new domain.

The Registry Mechanics

The California Government Operations Agency must establish the AI Auditor Registry by January 1, 2029. Beginning that date, anyone performing a covered audit without registration is operating illegally in the state. The registry itself is a gatekeeping mechanism: it doesn't mandate that every AI system be audited, but it controls who can do the work when California law requires it.

What exactly triggers an audit will depend on standards the Commission develops between now and 2029. But the scope is intentionally broad. Frontier AI labs are covered, but so are companies deploying off-the-shelf models for human resources, healthcare decisions, public benefits, and safety reviews.

Industry Support and Skepticism

The most striking aspect of these bills is who backed them. Anthropic publicly supported the legislation, and OpenAI joined them. This is notable because both companies, along with the broader tech industry, had pushed back hard against California's earlier regulatory attempts. The shift suggests that "independent third-party verification" is a more palatable framework than direct government limits on model capabilities.

But support from AI labs does not mean the framework is toothless. If anything, the auditing requirement could prove more consequential over time than one-time model safety thresholds. A system that requires ongoing independent review creates recurring accountability rather than a single checkpoint at training time.

The Federal Question

Newsom used the signing to make a direct appeal to Washington: "The federal government should do its part." California is once again trying to set the template for national policy, as it did with auto emissions standards and data privacy laws. Whether Congress takes up the question before 2029 is an open question, but the state's move creates a reference point that federal lawmakers will now have to engage with.

The Real Test Is Implementation

The signing is a milestone, but the hard part starts now. The Commission must define audit standards for a technology that is evolving faster than regulatory frameworks typically can. The registry must attract qualified auditors without creating an accreditation bottleneck. And companies subject to audits will need clarity on what "independent verification" actually looks like in practice.

There are also unanswered questions about enforcement. The bills create the registry and the standards body, but the penalties for non-compliance and the mechanisms for detecting violations are still largely undefined. A registry with teeth requires funding, staffing, and political will that extends well beyond a bill signing.

The Bottom Line

California's AI auditor registry is less dramatic than banning models above a certain size, but it may prove more durable. By focusing on who verifies systems rather than what those systems can do, the state sidestepped the innovation-versus-safety showdown that killed previous bills. The question now is whether the framework can attract competent auditors, set meaningful standards, and survive the inevitable legal challenges from companies that would prefer to keep grading their own homework.

The registry goes live in January 2029. Between now and then, every company deploying AI in California has time to prepare. The clock is ticking.